Getting Data In

How to separate IIS logs while parsing

riqbal47010
Path Finder

Hi Splunk Ninjas,

We have different web portals for different purposes. I categorize them as internal and external web portal.
Now under the cs_host field I have different values but both type of values are pointing as one web portal
for example.
cs_host=www.abc.com dvc/host= 1.2.3.4(External)
cs_host=abc.com dvc/host= 1.2.3.4(Internal)
cs_host=abc dvc/host= 1.2.3.4(Internal)
cs_host=www.xyz.com dvc/host= 1.2.3.4(External)
cs_host=xyz.com dvc/host= 1.2.3.4(Internal)
cs_host=xyz dvc/host= 1.2.3.4(External)

The idea comes in my mind to separate them based on either internal OR external
so if the cs_host=www.abc.com OR cs_host=www.xyz.com
then there should be another field name web_portal=external
and if cs_host=abc.com|abc OR cs_host=xyz|xyz.com
the cs_host values should become abc|xyz.

0 Karma
1 Solution

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

View solution in original post

0 Karma

hgrow
Communicator

Hi riqbal47010,

beside calculated fields this would be achived best with a csv-file and an lookup.

You can define input fields (f.e. "cs_host") for different output fields (f.e. "web_portal") in your csv file and make that an (automatc) lookup. Wildcards and mutlple field combinations work aswell. For your needs something like should be a good start:

"cs_host","web_portal"
"xyz.com","external"
"xyz.dev","internal"
"*.dev","internal"

If you have the lookup working make it automatic so it gets applied autoamticly to every search on the source/sourcetype or hosts.

Greetings

0 Karma

riqbal47010
Path Finder

dear Hgrow,

This idea mekes sense to you. can you please help me to achieve this. furthermore can I expand this to f5.

0 Karma

riqbal47010
Path Finder

OR in simple can we achieve beow:

if (cs_host = www.abc.com OR cs_host=www.xyz.com OR cs_host="www.*"), External, internal)

0 Karma

RHASQaL
Path Finder

I suspect you need to use something from what Splunk call Knowledge Objects, there's a document all about them . I'm sure there were some sessions from past .conf's that covered this. I think in a previous life (when Splunk was my main focus - I only dabble now) I found this session useful.

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...